Menu
I have two applications that need to talk to each other over HTTP. One is a PHP app and the other is my main app, the Rails app. I am needing the PHP app to talk to the Rails app by POSTing data to it, but when I do, I receive the Invalid Authenticity Token error. Is there anyway around this? Or how would I just create my own token to pass along the POST so that my Rails app authenticates?
662
How protect_from_forgery Works. The protect_from_forgery method in Rails 4.2. 6, which is the current stable version, turns on request forgery protection and checks for the CSRF token in non-GET and non-HEAD requests. If the application does not specify a strategy, it will default to nulling the session.
class ApplicationController < ActionController::Base protect_from_forgery with: :exception end. This with parameter is actually the forgery_protection_strategy parameter, it tells Rails how to behave when a CSRF attack is identified.
verify_authenticity_token() private. The actual before_action that is used to verify the CSRF token. Don't override this directly. Provide your own forgery protection strategy instead. If you override, you'll disable same-origin <script> verification.
Rails CSRF Token The server generates these tokens, links them to the user session, and stores them in the database. This token is then injected into any form presented to the client as a hidden field. When the client correctly submits the form for validation, it passes the token back to the server.
From the documentation for ActionController::RequestForgeryProtection::ClassMethods
You can skip the authentication token requirement either by specifying and :except or by forcing the before filter to be skipped....Example from the documentation...
class FooController < ApplicationController
protect_from_forgery :except => :index
# you can disable csrf protection on controller-by-controller basis:
skip_before_filter :verify_authenticity_token
end
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
